feat!: Update least privilege default service account

[gorge511]

This update follows changes from #1757 and reverts #1827.

The role roles/container.nodeServiceAccount is deprecated now and it is replaced with new roles/container.defaultNodeServiceAccount role. Unfortunately this is not yet documented in Google docs.

As the scope of the new role is smaller than the old one, this should be considered breaking change.

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

marked as breaking change per PR comment

[apeabody]

Thanks for the contribution @gorge511!

[gorge511]

Thanks for the contribution @gorge511!

Thanks for accepting my ideas and changes.

[davem-git]

how do we update to this from an older version? will it just delete and recreate this without any downtime?

[hSATAC]

Can anyone confirm is there any downtime of this SA recreation for old clusters upgraded to v30?

[mmorejon]

@gorge511 , could you share a reference about oles/container.defaultNodeServiceAccount? You mentioned there aren't docs in GCP but I was looking into the roles directly through the gcloud cli and I couldn't find anything about it.

[gorge511]

Can anyone confirm is there any downtime of this SA recreation for old clusters upgraded to v30?

Hi @hSATAC this change is without any downtime.

[gorge511]

@gorge511 , could you share a reference about oles/container.defaultNodeServiceAccount? You mentioned there aren't docs in GCP but I was looking into the roles directly through the gcloud cli and I couldn't find anything about it.

Hi @mmorejon, please see #1757 for a bigger discussion of why I did this PR. This is quite a new thing, but you can find the role easily with gcloud iam roles describe roles/container.defaultNodeServiceAccount and read all its permissions.

Unfortunately, this is so new that the public docs are not updated yet, but I got a thumbs up for using it from our Google TAM who consulted this with GKE developer team.